Ridvay Code OS Command Injection Vulnerability Leading to Remote Code Execution

A critical OS command injection vulnerability has been identified in Ridvay Code's command auto-approval module, affecting versions through 0.1.1. This vulnerability undermines the module's whitelist security mechanism by allowing attackers to exploit fragile regular expressions used for command validation. The issue arises from the module's failure to properly handle standard Shell command substitution, specifically with dollar sign parentheses and backticks. As a result, an attacker can inject malicious commands that are misidentified as safe, leading to remote code execution without any user interaction.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.